Suspicious Rundll32 Execution

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

This rule detects suspicious execution of rundll32.exe by looking for multiple instances of rundll32.exe executing with command lines containing both '.dll' and '/' characters from the same computer and account. This pattern can indicate an adversary attempting to proxy execution of malicious code via rundll32.exe.